CVE-2026-89569

CVE-2026-89569 is a use-after-free vulnerability in the Linux kernel Bluetooth RFCOMM subsystem. The function rfcomm_security_cfm() looks up an RFCOMM session and walks its DLC (data link connection) list without holding rfcomm_mutex , while the krfcommd thread can concurrently tear down and free...

CVE-2026-89567

CVE-2026-89567 affects the jbd2 (Journalling Block Device v2) subsystem of the Linux kernel . The root cause is that the jbd2 shrinker accounts only successfully released checkpoint buffers against its scan budget (nr_to_scan ), meaning busy buffers consume no budget. If a checkpoint transaction ...

CVE-2026-89566

CVE-2026-89566 affects the Linux kernel's jbd2 (ext3/ext4 journaling) subsystem. The vulnerability exists in journal_shrink_one_cp_list(): when called with JBD2_SHRINK_BUSY_SKIP, the continue statement used to skip busy checkpoint buffers bypasses the need_resched() check at the end of the loop b...

CVE-2026-89564

CVE-2026-89564 affects the Linux kernel 's IPv4 and IPv6 input paths. When a multicast packet is not locally deliverable, the original skb retains a stale skb->sk pointer installed by bpf_sk_assign() or UDP early demux , where no socket reference is guaranteed. After the prefetched socket is d...

CVE-2026-89565

In the Linux kernel , the ipip and mplsip tunnel drivers leak a socket buffer (skb) in collect_md mode when ip_tun_rx_dst() fails to allocate a metadata_dst struct via atomic allocation. The function ipip_tunnel_rcv() returns 0 without freeing the skb, and the callers (tunnel4_rcv() / tunnelmpls4...

CVE-2026-89563

CVE-2026-89563 affects the Linux kernel IPv6 tunnel subsystem (ip6_tunnel). The root cause is in ip6_tnl_xmit(), which used skb_realloc_headroom() to expand headroom before pushing outer IPv6 and optional encapsulation headers. That call consumed the original socket buffer while keeping the repla...

CVE-2026-89562

CVE-2026-89562 is a Linux kernel vulnerability in the ip6_gre module. The function ip6gre_tnl_link_config_route() incorrectly accumulates the lower device's hardware header length into dev->hard_header_len whenever header_ops is set. This misconfiguration affects both NBMA ip6gre tunnels (wher...

CVE-2026-89561

CVE-2026-89561 is a NULL pointer dereference in the Linux kernel's IPv6 RPL (Routing Protocol for Low-Power and Lossy Networks) segment routing path. The function ipv6_rpl_srh_rcv() reads idev->cnf.rpl_seg_enabled after calling __in6_dev_get() without a NULL check. When a device's MTU drops be...

CVE-2026-89560

CVE-2026-89560 is a Landlock LSM flaw in the Linux kernel affecting whiteout creation in userspace OverlayFS (fuse-overlayfs). Whiteout objects, used to mark absent files in the upper overlay layer, could be created via mknod(2) with S_IFCHR/makedev(0,0) or renameat2(2) with RENAME_WHITEOUT. The ...

CVE-2026-89559

CVE-2026-89559 is a Linux kernel vulnerability in the libnvdimm/labels subsystem. The on-media namespace index field nslot (a u32) is read from DIMM label storage or userspace via ND_CMD_SET_CONFIG_DATA. In __nd_label_validate(), the product nslot * label_size is evaluated in 32-bit unsigned arit...

CVE-2026-89558

CVE-2026-89558 affects the Linux kernel md/raid10 subsystem. A refactoring commit (fe6a19d40ceb) converted the still_degraded variable from int to bool but inverted its assignment—still_degraded = 1 became still_degraded = false. When a device is recovered while another mirror remains missing, th...

CVE-2026-89556

CVE-2026-89556 affects the Linux kernel module loader's ELF validity caching. In elf_validity_cache_sechdrs, section sizes and offsets are validated only when the section type is neither SHT_NULL nor SHT_NOBITS. However, elf_validity_cache_secstrings and elf_validity_cache_index_str subsequently ...

CVE-2026-89557

In the Linux kernel md (multiple device) subsystem, super_1_load() loads sb->bblog_shift (an __u8 value in range 0–255) from the on-disk superblock. This value is used as a left-shift on a 64-bit sector variable; an invalid shift value can cause integer overflow of sector, which then propagate...

CVE-2026-89555

Linux kernel MPLS multipath selection (mpls_select_multipath) contains a slab-use-after-free vulnerability. When mpls_multipath_hash() walks the MPLS label stack, it caches a header pointer (hdr). If pskb_may_pull() subsequently triggers pskb_expand_head() to replace the skb head, the cached poin...

CVE-2026-89554

Linux kernel MPTCP is affected by an uninitialized memory bug in the SYN cookie MP_JOIN reconstruction path. When rebuilding a request socket for a 4th-ACK MP_JOIN handled under SYN cookies, mptcp_token_join_cookie_init_state() restores several fields but fails to restore local_id. Since the requ...

CVE-2026-89553

A use-after-free race condition was identified in the nouveau GPU driver's gem subsystem of the Linux kernel . In the non-uvmm path , a race exists between the info ioctl finding a vma and the gem close path closing that vma, which can lead to a use-after-free. The fix reserves the buffer object ...

CVE-2026-89552

This Linux kernel vulnerability affects param_set_charp() in the kernel's params subsystem. The root cause is that the previous parameter value is freed before the replacement allocation succeeds; if kmalloc_parameter() fails, the parameter is left as NULL , leading to a kernel NULL pointer deref...

CVE-2026-89551

CVE-2026-89551 is a Linux kernel vulnerability in the SUNRPC subsystem, specifically in xdr_buf_trim(). The root cause is an unsigned integer underflow : when buf->len is smaller than the sum of the iovec lengths, the final accounting step (buf->len -= (len - trim)) wraps to near UINT_MAX. ...

CVE-2026-89550

CVE-2026-89550 affects the Linux kernel in the SUNRPC svcauth_gss subsystem. The function svcauth_gss_unwrap_priv() validated only an upper bound on the wire-supplied opaque token length before passing it to the GSS unwrap path. A token with a length in the range [0, 16] passes this check and rea...

CVE-2026-89548

This Linux kernel vulnerability affects the SUNRPC subsystem. In sunrpc_destroy_cache_detail(), the global cache_cleaner delayed work is only cancelled when cache_list is empty. During per-netns teardown , cache_list is never empty because init_net caches remain registered, so the cancel never fi...